The npm package time-linters-webapp-eslint-config version 20.2.2 contains malicious code that executes upon import or require. It downloads and runs an opaque platform-specific binary from suspicious Cloudflare Workers hostnames and a DNS-TXT fallback domain without any integrity verification. The malicious payload is disguised using fake telemetry framing and cover-story filenames. This behavior is unrelated to the package's intended ESLint configuration purpose and occurs silently on load.